Meeting Minutes: Board and BAC Monthly (2026-09-14)

Below are the minutes from the recent BAC and Board of Directors meeting. All members receiving this notification are encouraged to review the minutes and actively participate in the discussion. That's one of the opportunities to engage directly with BAC members by replying in the thread below. Your input helps us ensure the OpenSSL community remains transparent, collaborative, and responsive to your needs.

Attendees

Anton Arapov, Chris Ward, Jaroslav Reznik, Jeff Johnson, Randall Becker

High-level topics covered

• Conference logistics

• Community/BAC coordination role transition

• Joint BAC/TAC panel preparation

• OpenSSL version adoption and legacy platform support

• CRA reporting and cryptographic standards

• FIPS 140-3 / CMVP status

• Committee seat vacancies

Detailed points and discussion

1) Conference logistics

Attendance was confirmed for the Prague conference. Evening events are open to guests; there is no separate daytime programming. The speaker schedule was updated. Side-meeting space was requested for the large business and distributions communities; availability will be reviewed and formal room requests submitted.

2) Community coordination

Responsibility for community engagement, BAC/TAC coordination, and tracking of outstanding action items has moved to Chris Ward. Prior open action items, including delayed distribution of previous minutes, are being reviewed and closed out.

3) Joint BAC/TAC panel

A joint BAC/TAC panel is planned for the conference, to be moderated by Chris Ward, focused on topics where committee opinions differ. The next standing monthly meeting is cancelled in favor of a joint preparation call approximately three weeks before the conference.

4) OpenSSL version adoption

Migration status from OpenSSL 3.0 to 3.5 was reviewed. Adoption on the HPE NonStop platform is constrained by infrequent vendor LTS releases; a 3.5 package is expected this month. Post-quantum cryptography readiness was also discussed: server-side adoption is feasible, but constrained hardware (point-of-sale devices, routers with secure boot) requires physical replacement rather than software updates. Poll is live here.

5) CRA reporting and cryptographic standards

The CRA reporting portal has launched; registration requirements are under internal review. Concerns were raised about the EU Approved Cryptographic Mechanisms (ACM) list under CRA Annex K; feedback has been submitted to the EU.

6) FIPS 140-3 / CMVP

OpenSSL 3.5.8 was submitted to CMVP to include recent security patches.

7) Committee vacancies

The Small Business seat on BAC/TAC remains vacant; no immediate action is required unless a candidate comes forward.

Action items